Guest access: multiple sponsor groups and guest portals

[lnw-team]

Hello,

In my ISE deployment I've got several sponsor groups and guest portals. My objective is to allow members of a specific sponsor group to create guest accounts that can be used only in a specific guest portal, for example: 

- Members of Sponsor Group "France", where only local IT staff and receptionists can log on, can create accounts for Guest Portal that is used in policy for that location.

In a nutshell, I would like to avoid situation in which once guest account is created, it can be used in any location, in any guest portal.

Is it doable? 

[abertore · Accepted solution]

Hi,

You will need to manage this with different Authorization Policies:

- If Location A, and Guest Type A => Redirect to right portal and Permit Access
- If Location B and Guest Type B => Redirect to right portal and Permit Access

This is because all the Guests are in a single database in ISE so technically they could login in different portals, but you can prevent this restricting the access through Authorization Policies.

Different Sponsor groups can be restricted to manage different Guest Types so you can actually restrict some type of Sponsors to create/approve only a set of Guests. 

[lnw-team]

Hello, 

Thanks but unfortunately I cannot set such condition: "guest type" on Cisco ISE. Could you please point me the place where I can find it?